CVE-2026-60902: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-60902 is a local privilege escalation vulnerability in the Tuxedo component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. A low-privileged attacker with local logon access to the infrastructure where PeopleTools executes can exploit this difficult-to-exploit flaw to fully compromise the system. It was disclosed and patched on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU). The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (Oracle Advisory).

The vulnerability resides in the Tuxedo component of Oracle PeopleSoft Enterprise PeopleTools and is classified as a local privilege escalation (CWE category: Elevation of Privilege). Exploitation requires an attacker to already have low-privileged local logon access to the host system, and the attack complexity is rated High, indicating that specific conditions or race conditions must be met. No user interaction is required, and the scope remains unchanged upon successful exploitation. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation results in a full takeover of the PeopleSoft Enterprise PeopleTools instance, with high impact to confidentiality, integrity, and availability. An attacker could gain complete read access to sensitive PeopleSoft data, modify system configuration and application data, and disrupt service availability. The scope is limited to the affected system (unchanged scope), but a compromised PeopleTools host could expose sensitive enterprise HR, financial, or operational data managed by PeopleSoft (Oracle Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation of CVE-2026-60902 at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity and requirement for local access further reduce the practical exploitability of this flaw (Oracle Advisory).

Oracle has released patches for CVE-2026-60902 as part of the August 2026 Critical Security Patch Update (CSPU), applicable to PeopleSoft Enterprise PeopleTools versions 8.61–8.63. Oracle strongly recommends applying the patch immediately. As a temporary risk reduction measure, organizations should restrict local logon access to the PeopleTools infrastructure to only authorized administrators and enforce the principle of least privilege for all local user accounts. Monitoring for suspicious local activity and privilege escalation attempts on affected systems is also advised (Oracle Advisory).